install: harden install.sh (fail fast, guard the beta build path)

[Chemaclass]

Context

Follow-up to the build.sh hardening (#834). install.sh runs without set -euo pipefail (only per-rule shellcheck disables, including SC2164 for unguarded cd), and the beta build path compounds failures silently. Audit findings, install.sh:75-99 (build_and_install_beta):

Findings

1. Failed clone cascades into the user's working directory. git clone … temp_bashunit 2>/dev/null can fail (network, rate limit); the following cd temp_bashunit then fails (SC2164 suppressed), and ./build.sh bin >/dev/null executes in the user's cwd — polluting it with bin/ artifacts, or worse, rebuilding whatever repo the user happens to be standing in. The script then cp temp_bashunit/bin/bashunit ./ (fails), prints the success message and exits 0 with no (or a stale) binary.
2. No fail-fast anywhere. A failed download/build/copy still reaches the "installed" message; exit code 0. Same gate-hole class as the --verify bug fixed in fix(build): harden build.sh (verify gate, derived deps, dev bench) #835.
3. sed -i -e portability accident. On BSD/macOS sed -i consumes the next arg as the backup suffix, so -i -e writes a bashunit-e backup file; it only works by luck because the temp dir is deleted afterwards. Use an explicit suffix + rm, or a portable two-step.
4. local latest_commit=$(git rev-parse …) — local swallows the substitution's exit status (and SC2155 is globally disabled); harmless today but pattern-fixable while in there.

Acceptance criteria

• install.sh runs under set -euo pipefail; every failure path (clone, cd, build, checksum, copy) aborts with a clear error and non-zero exit — no success message after a failed step
• The beta path never executes build.sh outside the freshly cloned temp dir
• sed -i usage is BSD/GNU portable with no stray backup files
• Existing behavior preserved: stable install via curl/wget + checksum verification (including the documented cannot-verify fallback for pre-checksum releases), beta via clone+build, custom install dir argument
• tests/acceptance/install_test.sh extended: a simulated clone failure must exit non-zero and must not create bin/ in the caller's cwd (pattern: stub git via PATH shim, per .claude/rules/perf-fork-budget.md shim technique)

Constraints

• install.sh is downloaded and piped to bash by end users — portability matters most here: macOS default bash 3.2 + BSD tools, Linux/GNU, and busybox-ish environments
• TDD: failing acceptance test first for the cwd-pollution scenario
• Quality gate: ./bashunit tests/ && ./bashunit --parallel --simple --strict tests/ && make sa && make lint

Verification

./bashunit tests/acceptance/install_test.sh
make sa && make lint

[Chemaclass]

Done in #841 (merged). install.sh fails fast; beta clone failure can no longer run build.sh in the caller's directory; portable sed edit.